Kerentanan perangkat lunak dan perangkat keras yang perlu diperhatikan administrator sistem di Perangkat Daerah, diperbarui otomatis dari NVD, KEV CISA, dan EPSS.
Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.
| CVE | Severity | KEV | EPSS | Terbit |
|---|---|---|---|---|
|
CVE-2026-69743
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-69736
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privile...
|
7.0 High | — | 0,21% | 13 Okt 2026 |
|
CVE-2026-69733
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,44% | 13 Okt 2026 |
|
CVE-2026-69721
Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-69718
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,96% | 13 Okt 2026 |
|
CVE-2026-69705
Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,79% | 13 Okt 2026 |
|
CVE-2026-69675
Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-69673
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,46% | 13 Okt 2026 |
|
CVE-2026-69651
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,1% | 13 Okt 2026 |
|
CVE-2026-69650
Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,23% | 13 Okt 2026 |
|
CVE-2026-69644
Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,49% | 13 Okt 2026 |
|
CVE-2026-69640
Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a security feature over a network.
|
5.3 Medium | — | 0,63% | 13 Okt 2026 |
|
CVE-2026-69639
Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,79% | 13 Okt 2026 |
|
CVE-2026-69635
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges with a physical attack.
|
6.6 Medium | — | 0,41% | 13 Okt 2026 |
|
CVE-2026-69634
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
|
9.8 Critical | — | 0,79% | 13 Okt 2026 |
|
CVE-2026-69633
Heap-based buffer overflow in Windows Update allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-69596
Use after free in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-69577
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
|
7.5 High | — | 0,97% | 13 Okt 2026 |
|
CVE-2026-69521
Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,66% | 13 Okt 2026 |
|
CVE-2026-69506
Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
|
4.7 Medium | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-69471
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-69454
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
|
7.5 High | — | 0,97% | 13 Okt 2026 |
|
CVE-2026-69452
Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network.
|
7.1 High | — | 0,58% | 13 Okt 2026 |
|
CVE-2026-69387
Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
|
7.0 High | — | 0,27% | 13 Okt 2026 |
|
CVE-2026-69370
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,70% | 13 Okt 2026 |
|
CVE-2026-69363
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network.
|
8.0 High | — | 0,61% | 13 Okt 2026 |
|
CVE-2026-69354
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-69326
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
|
8.8 High | — | 0,64% | 13 Okt 2026 |
|
CVE-2026-68836
Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-66822
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
|
5.9 Medium | — | 0,67% | 13 Okt 2026 |
|
CVE-2026-62879
Missing authentication for critical function in Windows SmartScreen allows an authorized attacker to perform tampering locally.
|
5.5 Medium | — | 0,31% | 13 Okt 2026 |
|
CVE-2026-62687
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.
|
5.5 Medium | — | 0,45% | 13 Okt 2026 |
|
CVE-2026-61931
Use after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-59116
Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.
|
6.8 Medium | — | 0,36% | 13 Okt 2026 |
|
CVE-2026-58280
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
|
7.5 High | — | 1,1% | 13 Okt 2026 |
|
CVE-2026-54086
SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker-controlled body length and al...
|
5.3 Medium | — | 0,49% | 13 Okt 2026 |
|
CVE-2026-49785
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
|
7.8 High | — | 0,34% | 13 Okt 2026 |
|
CVE-2026-110256
Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the L...
|
3.7 Low | — | 0,32% | 13 Okt 2026 |
|
CVE-2026-110255
Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to make the server fetch arbitrary...
|
8.5 High | — | 0,26% | 13 Okt 2026 |
|
CVE-2026-110254
Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT6...
|
4.3 Medium | — | 0,25% | 13 Okt 2026 |
|
CVE-2026-110240
Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, CGNAT and transition addresses...
|
4.8 Medium | — | 0,33% | 13 Okt 2026 |
|
CVE-2026-110239
Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML without...
|
4.4 Medium | — | 0,24% | 13 Okt 2026 |
|
CVE-2026-110238
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or...
|
8.8 High | — | 0,46% | 13 Okt 2026 |
|
CVE-2026-110237
Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as an...
|
7.3 High | — | 0,15% | 13 Okt 2026 |
|
CVE-2026-110236
KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted...
|
7.0 High | — | 1,0% | 13 Okt 2026 |
|
CVE-2026-110235
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitiz...
|
5.5 Medium | — | 0,29% | 13 Okt 2026 |
|
CVE-2026-110234
Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creating symbolic links at predicta...
|
4.4 Medium | — | 0,14% | 13 Okt 2026 |
|
CVE-2026-110233
Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can de...
|
7.8 High | — | 1,1% | 13 Okt 2026 |
|
CVE-2026-110232
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an u...
|
3.3 Low | — | 0,21% | 13 Okt 2026 |
|
CVE-2026-110231
muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSli...
|
4.7 Medium | — | 0,20% | 13 Okt 2026 |